CVE-2026-71849

Name of the Vulnerable Software and Affected Versions Hono versions 4.7.0 through 4.12.33

Description The Proxy Helper proxy() function in hono/proxy fails to remove response headers specified by the origin's Connection header. According to RFC 9110 Section 7.6.1, intermediaries must remove header fields listed in the Connection header before forwarding the message, along with standard hop-by-hop headers. Because the proxy() function only removes well-known hop-by-hop headers, clients may receive non-standard headers intended only for the immediate peer. This can result in the disclosure of internal metadata or connection-scoped information when the origin declares additional headers as hop-by-hop.

Recommendations Update Hono to version 4.12.34.